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Sir: 
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Please enter the enclosed Certificate of Correction (PTO 
Form 1050) in the above patent. 

The errors sought to be corrected were made by 

I X I The Patent and Trademark Office as explained below. 
Thus, no fee is required for the Certificate of 
Correction pursuant to 37 CFR §1.322. 

| | Applicant (s) (at least in part). See next section 
^ * for explanation. This appropriate fee under 3 7 CFR 
§1.323 has been authorized below. 



Attached as Exhibit A (1 page) is a copy of the relevant 
page of the Amendment filed on May 17, 2007. This Exhibit 
supports the requested correction to Claim 16, and shows that 
the error was made by the U.S. Patent and Tradei^^k^55ice?T^ 
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Serial No.. 10/633,907 



) As shown in Exhibit A, Line 9 of originally numbered Claim 

| 17 (renumbered in the Patent as Claim 16) after "upon a", reads 
"...determination...". The same line in the patent at Column 20, 
Line 6 reads u ...de termination..." . 

Although it is believed that no fee is required, the 
Commissioner is hereby authorized to charge any fees required 
for consideration and entry of the enclosed documents, and to 
credit any overpayment of fees to Deposit Account No. 50-0553. 

Please direct all inquiries concerning this request to the 
undersigned attorney. 



CERTIFICATE OF MAILING 

I hereby certify that this correspondence is being deposited with 
the United States Postal Service with sufficient postage as first 
class mail in an envelope addressed to: Attention: Certificate of 
Corrections Branch, Commissioner for Patents, P.O. Box 1450, 
Alexandria, VA 22313-1450, on February 20, 2008 . 




Attorney for Applicant(s) 



February 20, 2008 
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Lisa' A. Norris 
Attorney for Applicant (s) 
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Appl. No. 10/6f '^907 
Amendment and Response dated May 17, 2007 
Reply to Office Action of March 26, 2007 



15. (Original) The malicious code detection device of 
Claim 12, further comprising a memory area coupled to the 
intercept module and the analyzer module. 

16. (Original) The malicious code detection device of 
Claim 12, wherein the intercept module includes an interception 
mechanism for intercepting a request. 

17. (Previously amended) A computer program product 
comprising a computer -readable medium containing computer 
program code for a method comprising: 

stalling a request on a host computer system prior to 
sending the request to a target computer system; 

determining whether the request is suspicious; 

wherein upon a determination that the request is not 
suspicious, releasing the request; and 

wherein upon a determination that the request is 
suspicious, adding a request entry to a request database, 
the request entry identifying the request, 

generating a counter value associated with the 
request entry, 

determining whether the counter value meets a counter 
value threshold, and 

wherein upon a determination that the counter value 
meets the counter value threshold, determining that 
malicious code activity is detected. 
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18. (Original) The computer program product of Claim 17, 
the method further comprising: 

wherein upon a determination that malicious code activity 
is detected, generating a notification that malicious code 
activity is detected; and 

implementing one or more protective actions. 
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UNITED STATES PATENT AND TRADEMARK OFFICE 

CERTIFICATE OF CORRECTION 

Page _t of _1 

PATENT NO. 7,325,185 
APPLICATION NO.: 1 0/633,907 

ISSUE DATE January 29, 2008 

inventor(S) Peter Szor 

It is certified that an error appears or errors appear in the above-identified patent and that said Letters Patent 
is hereby corrected as shown below: 

In Column 20, Line 6, in Claim 16, after "upon a", replace "de termination" with -determination-. 



MAILING ADDRESS OF SENDER (Please do not use customer number below): f 

GUNNISON, McKAY & HODGSON, LLP. I 
1900 Garden Road, Suite 220 | 
Monterey, CA 93940 ] 

This collection of information is required by 37 CFR 1.322, 1.323, and 1.324. The information is required to obtain or retain a benefit by the public which is to file 
(and by the USPTO to process) an application. Confidentiality is governed by 35 U.S.C. 122 and 37 CFR 1.14. This collection is estimated to take 1.0 hour to 
complete, including gathering, preparing, and submitting the completed application form to the USPTO. Time will vary depending upon the individual case. Any 
comments on the amount of time you require to complete this form and/or suggestions for reducing this burden, should be sent to the Chief Information Officer, 
U.S. Patent and Trademark Office, U.S. Department of Commerce, P.O. Box 1450, Alexandria, VA 22313-1450. DO NOT SEND FEES OR COMPLETED 
FORMS TO THIS ADDRESS, send TO: Attention Certificate of Corrections Branch, Commissioner for Patents, P. O.-Box^1450, Alexandria, 
VA 22313-1450. : - llil WPTQ 

If you need assistance in completing the form, call 1-800-PTO-9199 and select option 2. 

FEB 2 8 2008 



